CVE-2022-49990

A flaw was found in the Linux kernel's s390 architecture subsystem. When a process creation (fork) operation encounters an error after duplicating task structures, internal control block memory pointers are not cleared in time and are released prematurely. A local user can exploit this double-free vulnerability to cause memory corruption, leading to a system crash and Denial of Service (DoS).

A moderate impact flaw was found in the Linux kernel's s390 (IBM Z) architecture support, as shipped in the Red Hat Enterprise Linux 7, 8, and 9 kernels (kernel and kernel-rt) and in the Hosted OpenShift offerings (ARO 4 and OSD 4) that run those kernels. When a fork() operation fails after the new task structure has been duplicated but before copy_thread() clears the guarded storage (GS) and runtime instrumentation (RI) control block pointers, the error cleanup path (free_task() -> arch_release_task_struct()) frees control blocks that still belong to the parent task, resulting in a double free of that memory. A local user able to run code on an affected s390x system could exploit this error path to cause memory corruption and a kernel crash, resulting in a denial of service. The vulnerable code is specific to the s390x architecture, so systems running other architectures are not exposed, and Red Hat Enterprise Linux 10 and Red Hat In-Vehicle OS are not affected because the vulnerable code is not present in their kernels. Fixes for the affected streams are currently deferred; because the impact is limited to availability on a single architecture and requires local access, the residual risk is that a local attacker on an s390x system could trigger memory corruption leading to a system crash and denial of service. Red Hat rates this flaw as Moderate (CVSS 3.1 score 5.5, availability impact only), lower than the 7.8 (Important) score assigned by NIST and CVE.org, because on supported configurations the double free manifests as a crash caught by kernel hardening or debugging checks (for example a BUG_ON() with CONFIG_SLAB_FREELIST_HARDENED or a KASAN report) rather than a demonstrated compromise of confidentiality or integrity.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.